CCR-2026-0031: attended bootstrap passed (PAT read:repository only, probe/denials verified, OpenBao written and read back)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3775@bnt-lap001
Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3

credential-change-requests/CCR-2026-0031-core-hub-forgejo-source-read.yaml

@@ -173,6 +173,26 @@ verification:
     - 'Policy metadata write: sys/policies/acl/workload-kv-read-core-hub-forgejo-source'
     - 'Auth role metadata write: auth/kubernetes/role/external-secrets-core-hub-forgejo-source'
     - No secret values were read, written, printed, or accepted in argv.
+  - at: '2026-10-03T08:10:11+00:00'
+    actor: attended operator via governed platform-admin lane
+    kind: delegated_metadata_apply
+    result: passed
+    details:
+    - Delegated metadata applier ran as attended operator via governed platform-admin
+      lane using local bao CLI ambient authority.
+    - 'Policy metadata write: sys/policies/acl/workload-kv-read-core-hub-forgejo-source'
+    - 'Auth role metadata write: auth/kubernetes/role/external-secrets-core-hub-forgejo-source'
+    - No secret values were read, written, printed, or accepted in argv.
+  - at: '2026-10-03T08:10:16+00:00'
+    actor: attended operator via governed platform-admin lane
+    kind: forgejo_source_bootstrap
+    result: passed
+    details:
+    - Restricted user core-hub-source and all-repository repo.code-read team core-hub-source-readers
+      verified; PAT core-hub-source-read-20261003T081013Z reports exactly read:repository;
+      private probe coulomb/rapp-openbao branch and archive read passed; effective
+      permission read-only; Actions-secret and instance-admin probes denied; OpenBao
+      field written from stdin and read back without value output.
 lifecycle:
   deactivate: Delete ExternalSecret and Secret in core-hub, unset publisher.existingSecret,
     revoke the PAT, disable the auth role, and leave private sources failing closed.